Re: Session Question

At 20:24 21.05.2003, Pushpinder Singh Garcha said: --------------------[snip]-------------------- >I am making use of sessions in my site. After a user logs in >successfully I register a session using the 'login' value and allow >such a user access to protected ares of the site. During the next phase >of the design, I want to be able to create protected pages for >"Advanced" users. These "Advanced" users have the same privileges as >normal users but also have additional access rights to the site. > >Each advanced user has a customized page and only he should be able to >have access to his page. My idea is to compare the session name with >the login of the advanced user. If the 2 match , then display the page >to the user else prevent access to the page. Please advise how secure >would such a scheme be? --------------------[snip]-------------------- What do you mean with "session name"? Maybe PHPSESSID, a value that can be read any changed with the session_name() function? This approach would be more than insecure since the session name is passed through the client where it may be forged. Having however a "name" field in the $_SESSION array then the approach might be possibly secure, depending on a couple of other factors: - register_globals is off - session.save_path is read/writable only by the user the webserver impersonates as - you provide some other means to minimize the possibility of "hijacking" sessions I'm sure others will chime in with their ideas, too. -- >O Ernest E. Vogelsinger (\) ICQ #13394035 ^ http://www.vogelsinger.at/